Information clause for Grupa LOTOS S.A. shareholders
who are natural persons and proxies of Grupa LOTOS S.A. shareholders

Pursuant to Art. 13 and Art. 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27th 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (“GDPR”), you are hereby informed that:

I. Personal data controller

The controller of your personal data is Grupa LOTOS S.A., having its registered office at ul. Elbląska 135, Gdańsk, Poland. You may contact us as follows:

a) using an online contact form available at http://www.lotos.pl/179/c.1/grupa_kapitalowa/kontakt,
b) by email at wz@grupalotos.pl,
c) by post at ul. Elbląska 135, 80-718 Gdańsk, Poland.

II. Data Protection Officer

Grupa LOTOS S.A. has appointed a Data Protection Officer, who you may contact in all matters concerning personal data processing or the exercise of your personal data protection rights.

You may contact the Data Protection Officer as follows:

a) using an online contact form available at http://www.lotos.pl/179/c,29/grupa_kapitalowa/kontakt,
b) by email at iod@grupalotos.pl,
c) by post at ul. Elbląska 135, 80-718 Gdańsk, Poland, FAO: Data Protection Officer

III.  Categories, scope and origin of personal data

Your personal data as a shareholder or a proxy of a shareholder has been obtained from Krajowy Depozyt Papierów Wartościowych S.A. of Warsaw (Central Securities Depository of Poland, “CSDP”) or directly from you.

The scope of personal data processed includes ordinary data, such as your first name and surname and address of residence.

Shareholders or proxies of shareholders mean natural persons who are entitled to participate in the General Meeting, have proven their status as a shareholder or a shareholder's proxy, have requested the provision of a list of shareholders entitled to participate in the General Meeting of Grupa LOTOS S.A. or a list of shareholders present at the General Meeting, have requested the provision of copies of submitted proposals concerning matters placed on the agenda of the General Meeting, have requested the convening of a General Meeting, have requested the placing of certain matters on the agenda of the General Meeting, or have proposed a draft resolution of the General Meeting.

IV.  Purposes of personal data processing

Your personal data is processed in order to enable the proper performance of support tasks for persons holding shares in Grupa LOTOS S.A., including to enable the holding of the General Meeting of Grupa LOTOS S.A. and participation therein, the preparation and making available, upon request, of the list of shareholders and, if appropriate, the exercise of the right to profit distribution, as well as the fulfilment of any legal or regulatory requirements applicable to Grupa LOTOS S.A. as a public company.

V. Legal basis for personal data processing

Your personal data is processed for the purposes specified above pursuant to:

a)  Art. 6(1)(c) of the GDPR, i.e. to enable Grupa LOTOS S.A. to comply with legal obligations arising under:

• Art. 341 (share register), Art. 347 (profit distribution), Art. 407 (list of shareholders), and Art. 429 (request for information) of the Commercial Companies Code,
• Art. 70.3 (disclosure obligations of public companies) of the Act on Public Offering, Conditions Governing the Introduction of Financial Instruments to Organised Trading, and Public Companies,
• Chapter 2 (current reporting by issuers) of the Minister of Finance’s Regulation on current and periodic information to be published by issuers of securities and conditions for recognition as equivalent of information whose disclosure is required under the laws of a non-member state,
• Art. 19(3)(disclosure obligations of issuers) of Regulation (EU) No 596/2014 of the European Parliament and of the Council on market abuse (market abuse regulation) and repealing Directive 2003/6/EC of the European Parliament and of the Council and Commission Directives 2003/124/EC, 2003/125/EC and 2004/72/EC;

b)  Article 6(1)(f) of the GDPR, i.e. to enable Grupa LOTOS S.A. to communicate with shareholders, verify their identity, and, if necessary, pursue or defend claims.

VI. Disclosure of personal data

Recipients of your personal data may include other shareholders as they are entitled to access the list of shareholders, which may be available at the Management Board's office, and to obtain a copy thereof. Also, if you hold at least 5% of total voting rights at the General Meeting, your personal data may be published in current reports and submitted to the Polish Financial Supervision Authority.

Your personal data may also be provided to the following categories of recipients:

a) personal data processors engaged by Grupa LOTOS S.A., including providers of ICT services used for the purposes specified above,
b) providers of other services to Grupa LOTOS S.A., including providers of shipping and postal services, legal and financial advisory services, and auditing services, 

with the proviso that they process data under an agreement with Grupa LOTOS S.A. and exclusively in accordance with its instructions. Your personal data may also be made available to public authorities exercising their public powers.

VII. Data storage period

Your personal data:

a)  that is included in the share register is processed throughout the duration of Grupa LOTOS S.A.’s business activities;
b)  that is included in lists of shareholders and that, where appropriate, is necessary for the exercise of the right to profit distribution or that is included in attendance lists or in documents confirming your right to act as representative on behalf of another and that enables contacting you by email is stored for a period of one year from the date of the General Meeting;
c) that is processed in connection with a challenge brought against a General Meeting resolution is stored until the competent court enters a final and unappealable decision on the challenge;
d) that is used for the purposes of handling an inquiry or complaint (other than data necessary to prove legal succession in the share register) is processed throughout the duration of the investigative procedure and, following its closure, for a maximum period of three years, i.e. until potential claims become time-barred;
e) that is processed for purposes other than those specified above is processed for as long as Grupa LOTOS S.A. is required to store such data for the purposes specified in Section IV hereof and, following the expiry of such requirement, for the period and to the extent required under applicable laws or regulations.

VIII. Rights of data subjects

Under the GDPR, you have the right to:

a) access your data and receive a copy thereof,
b) rectify (correct) your data,
c) demand erasure or restriction of processing of your data,
d) object to the processing of your data on grounds relating to your particular situation, where your data is processed on the basis of Grupa LOTOS S.A.’s legitimate interests. Such an objection may be raised at any time by email or by a letter sent to the addresses given above,
e) lodge a complaint with the President of the Personal Data Protection Office if you believe your personal data is processed in contravention of the applicable personal data protection regulations.

IX. Freedom to provide data

Provision of your personal data is required under law for the purposes specified in Section IV hereof.

X.  Personal data profiling

Your personal data will not be profiled or used for automated decision making (as defined in Art. 4(4) of the GDPR).